CVE-2019-10754 Use of Insufficiently Random Values in Apereo CAS

What is CVE-2019-10754?

CVE-2019-10754 is a high-severity vulnerability in Apereo CAS, published on 23 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Weakness: CWE-338

Which versions are affected by CVE-2019-10754?

12 open source packages ship an affected version, including org.apereo.cas:cas-server-core-services-api, org.apereo.cas:cas-server-core-services-authentication and org.apereo.cas:cas-server-support-oauth-core-api. It affects 1 product.

Products include Apereo Central Authentication Service.

How do I fix CVE-2019-10754?

Upgrade org.apereo.cas:cas-server-core-services-api to 6.1.0-RC5 or later.

Is CVE-2019-10754 being exploited?

There is no known exploitation of CVE-2019-10754 in the wild and no public exploit code.

Other vulnerabilities in Apereo CAS

• CVE-2023-4612 MFA bypass in Apereo CAS Critical 9.8
• CVE-2024-4399 CAS <= 1.0.0 - Unauthenticated SSRF Critical 9.1
• CVE-2020-27178 Improper Authentication in Apereo CAS High 7.5
• CVE-2015-1169 Auth bypass in n/a High 7.5
• CVE-2024-11208 Apereo CAS login session expiration Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g24w-373r-5pxg.